Lock SafeSearch for accounts, devices & networks you manage

If you manage accounts, devices, or networks, SafeSearch can help you filter explicit content from Google search results. If you want to keep SafeSearch turned on and prevent users from turning it off, you can lock SafeSearch.

Important: This article is intended for people who manage SafeSearch settings for others. To change SafeSearch settings for your personal account, follow the steps to filter explicit results using SafeSearch.

What you can lock SafeSearch for

• Accounts you manage as a parent, guardian, or school administrator
• Devices you manage including Chromebooks, Windows, Mac, and Linux
• Networks you manage at school, work, or home

Lock SafeSearch for devices you manage

If you supervise your child’s device with Family Link

If you’re a parent in the child’s Google Family Group, you can keep SafeSearch turned on for your child’s account on supervised Android devices and Chromebooks with Family Link. Learn more about Search and your child’s Google Account.

If you manage devices through Google Workspace for Education

To make web browsing safer, SafeSearch is turned on by default for:

• Users who are under 18 and signed in to Google Search with their Google Workspace for Education accounts on any browser
• Users who are signed in to their Google Workspace for Education accounts from  K-12 institutions on Chrome browsers

If you’re a Google Workspace for Education administrator, learn how to control access to Google services by age.

If you manage a Chromebook

If you’re an admin who manages Chrome policies from the Google Admin console, you can set SafeSearch preferences at the device level. Learn how to set Chrome policies for users or browsers.

If you manage a Mac, Windows, or Linux device

If you want to guarantee SafeSearch results on another device that you manage, like a PC or Macbook, you can map Google domains to forcesafesearch.google.com.

This option is recommended if you have a technical background.

Map google domains to forcesafesearch.google.com

This method leverages SafeSearch VIP to force all users on your network to use SafeSearch on Google Search while still allowing a secure connection via HTTPS. The VIP in SafeSearch VIP refers to a Virtual IP, which is an IP address that can be routed internally to multiple Google servers. We will serve SafeSearch results for all requests that we receive on this VIP, which includes Google search, image search, and video search.

It works for all browsers on your device and only users who are administrators on the device can undo this change. To make this change follow these steps:

In Windows

1. In Windows, click the Windows key and type Notepad.
2. Right click on Notepad and choose Run as Administrator.
3. Click Yes when Windows asks if you want this program to make changes.
4. In Notepad, open your hosts file. In most Windows installations, this is located at: C:\Windows\System32\drivers\etc\hosts
5. Click the Windows key, type cmd and hit enter. This will open Command Prompt.
6. Enter the command ping forcesafesearch.google.com and note the IP address. The IP address will look something like: 216.239.38.120.
7. Create an entry at the end of hosts file with the IP address you obtained. For example: 216.239.38.120 www.google.com #forcesafesearch.
   • Important: Copy this line for any other Google country domains your users may use, like www.google.co.uk.
8. Save the hosts file.

To confirm SafeSearch is on, go to google.com and check that SafeSearch is on by default and can't be turned off.

Tip: If Windows is installed in a different location on your PC, you can find the hosts file by typing the following command in Command Prompt: cd /d %systemroot%\system32\drivers\etc.

On MacOS

1. Open Terminal.
2. Enter the command ping forcesafesearch.google.com and note the IP address. The IP address will look something like: 216.239.38.120.
3. Enter the command sudo nano /private/etc/hosts.
4. Create an entry at the end of the hosts file with the IP address you obtained. For example: 216.239.38.120 www.google.com #forcesafesearch.
   • Important: Copy this line for any other Google country domains your users may use, like www.google.co.uk.
5. Save the hosts file.

To confirm SafeSearch is on, go to google.com and check that SafeSearch is on by default and can't be turned off.

On Linux

1. Open Terminal.
2. Enter the command ping forcesafesearch.google.com and note the IP address. The IP address will look like: 216.239.38.120.
3. Enter the command sudo nano /etc/hosts.
4. Create an entry at the end of the hosts file with the IP address you obtained. For example: 216.239.38.120 www.google.com #forcesafesearch.
   • Important: Copy this line for any other Google country domains your users may use, like www.google.co.uk.
5. Save the hosts file.

To confirm SafeSearch is on, go to google.com and check that SafeSearch is on by default and can't be turned off.

Lock SafeSearch for a school, workplace, or home network you manage

If you manage a school, workplace, or home network, you can force SafeSearch setting for all browsers and devices using your network. This applies the SafeSearch Virtual IP address to all Google domains you include in the configuration and can't be undone at the browser level.

To force SafeSearch for your network, you’ll need to update your DNS configuration. Set the DNS entry for www.google.com (and any other Google country domains your users may use) to be a CNAME for forcesafesearch.google.com.

Report explicit content

If you have SafeSearch turned on and you find explicit content, you can report the content.

Related resources

• Filter explicit results on Google using SafeSearch
• Fix issues with SafeSearch